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Lesson “Welcome” Slide 1 “Welcome" 






(U//F©tie) Welcome to the Business 
Records (BR) FISA web-based 
training (WBT). 



Lesson 1 -Introduction to the 
Business Records (BR) FISA 
Lesson 2 -Reasonable Articulable 
Suspicion (RAS) 

Lesson 3 - First Amendment 
Considerations 

Lesson 4 - The BR FISC Order 
Lesson 5 - Accessing, Sharing, 
Dissemination, and Retention 



fTO//OI//Nr) This course provides 
training for analysts who will be 
authorized to query the raw metadata 
collected by the BR FISA. 



(U// rOUQ) The course is comprised of 
five Lessons. 



(TG/ZG I Z/NT) The lessons contained in 
the BR FISA course are: 

» Lesson 1 -Introduction to the 
Business Records (BR) FISA 

• Lesson 2 -Reasonable 
Articulable Suspicion (RAS) 

• Lessor 3 - First Amendment 
Considerations 

8 Lesson 4 - The BR FISC Order 

• Lesson 5 -Accessing, Sharing, 
Dissemination, and Retention 



Derived From: NSA/CSSM 1-52 
Dated: 20070108 
Declassify On: 20341 SOT 
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Lesson “Welcome” Slide 2 “Lesson Titles and Lesson objectives :£^j 



(U// FOUO) The course begins with an 
overview of the BR FISA authority and 
then moves into an overview of the 
Reasonable Articulable Suspicion 
standard. Next, students will explore 
First Amendment considerations 
before taking a closer look at the BR 
FISC Order. The BR Order points out 
special considerations that distinguish 
this FISA authority from other FISAs 
typically encountered at this Agency. 
The final lesson of this course 
provides specific rules and procedures 
regarding the access, sharing, 
dissemination, and retention of BR 
FISA metadata. 



Business Records (BR) FISA 
Course Welcome— 
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Lesson “Wei corns", Slide 3 Course Objectives 



At the conclusion of this course you 
should be able to: 



•Identify terms and processes 
associated with the Business Records 
FISA Order 

•Identify common sources of 
information used for determining RAS 
• State limitations for targeting US 
persons under the RAS standard 
•Identify access, sharing, 
dissemination, and retention 
procedures under the BR FISA Court 
Order 



•Identify terms and processes associated with the 
Business Records FISA 

•Identify common sources of information used for 
determining RAS 

•State limitations for targeting US persons under the 
RAS standard 

•Identify access, sharing, dissemination, and retention 
procedures under the BR FISA Order 
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Lesson “Welcome”, Slide 4 “Legal Readings Access' 



(U/ /FOUO) A s you progress through 
the different course lessons you may 
want to also access the related Legal 
Readings. The two core readings are 
the Reasonable Articulable Suspicion 
('RASi memorandum written by UGC 
and the BR FISC Order issued by the 
FISA Court. 



(U/ /rOLJO )-You can access these 
documents by clicking on the Legal 
Readings button located in eCampus 
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Business Records (BR) FISA 
Course Welcome— 
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Lesson 1 Slide 1 introduction and Definitions 



(TQ//0 1 //ND The Business Records (BR) 

FISA is a specific authority given by the 
Foreign Intelligence Surveillance Act Court 
(FISC) that allows NSA to obtain metadata 
from the business records of certain 
specified telecommunication companies. 



BR FISA = Specific authority given by 
the FISA Court (FISC) that allows NSA 
to obtain metadata from the business 
records of certain specified 
telecommunication companies. 



f rs//s i //N f^This data consists of telephony 
metadata obtained from business records 
provided under a court order by US 



fFStfSfaWF) This FISA is authorized because 
the FISC recognizes there is a 
counterterrorism interest in obtaining those 
business records. However, because 
there is a great deal of US person 
communications within those business 
records, the FISC and NSA have instituted 
strict guidelines on the collection, 
processing, retention, and dissemination of 
the metadata. 



■ (TS//S l //Nr) You can access the most 
current BR Order from the links on the 
Legal Readings button in this course^. 



Mouse Over: U] (TS//SI//NF) ■■■ 
refers to electronic communications 
service providers located inside of the 
United States who a^iadSiUUiii 



D e riv e d From: NSA/CSSM 1 - 52 



AO 
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(TS//S I //MF) i his lesson wili enable 



Lesson 1 - Introduction to the BR 



•Identify the purpose of the BR FISA 
•Recognize the 

groups covered by the BR FISA Court 
Order 

•Define terms relevant to the BR FISA 
Order: telephony metadata, telephony 
identifier, hops, and Seed 



Objectives 



• Identify the purpose of the BR 

FISA 



_groups covered by the 
BR FISA Order 

•Define terms relevant to the BR 
FISA Order: telephony metadata 
telephony identifier, hops, and 



«**%*». 



Lesson 1 - Introduetipp to the Business 
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Lesson 1 Slide 3 Oven/iew of-RAS- 



(U/ /rOUO) Before we begin, you will need 
to understand some key terms. To 
access a vocabulary list please use the 
legal readings link on the right side of the 
page and open the BR Glossary. Let’s 
review a few of the terms you’ll use in this 
course now. 

(TS//S I //NF) The term associated is 
defined to mean “engaged in a common 
enterprise” with: 



Overview of HAS 



The term associated is defined in the RAS Memo to 
mean, “engaged in a common enterprise” with: 



| listed in the Order or 
The BR FISA Order list specific 
groups that to 

affiliatet jwith^^^MlttjSBg^M 

■These 

are groups designated by the 
National Counter Terrorism Center 
(NCT Cj to have aji edibg m selves 
with ■11 

No other groups other than those 
listed in the BR FISC Order can be 
used to justify access under the BR 
FISA authority. This list can be 
obtained from a Homeland Mission 
Coordinator (HMC). Because the 
FISC Order is typically renewed 
every 60-90 days, the list of terrorist 
groups is subject to change. 



One of the groups designated by the National 
Counter Terrorism Center (NCTC) to have allied 



Someone acting as their agent 



No other groups other than those listed in the BR 
FISC Order can be used to justify access under 
the BR FISA authority. 



; £1] The NCTC list also 
identifies known aliases for groups listed in 
the Order 
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Lesson 1 - Introduction to the Business 
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“Telephony Metadata and Telephony Identifers” 

Telephony metadata 

Metadata collected - includes comprehensive communications routing 
information 

• Originating and terminating telephone numbers 

» International Mobile Subscriber Identity (IMSI) numbers 

• Mobile Subscriber Integrated Services Digital Network (MSISDN) 
numbers 

tt International Mobile station Equipment identity (IMEI) numbers 

• Trunk identifiers 

• Telephone calling card numbers 

- Time and duration of calls 

Telephony metadata does NOT include 

» Substantive content of any communication 

• Name, address, or financial information about a subscriber or 
customer 

Telephony identifiers correlate to Business Records metadata collected by 
the providers, such as MSISD^or^callin^ar^riumbej^ Telephony 
identifiers are also known as:^H^^^^B^k^^^^Bdenfifiers. 




(TG//G I / / NO Here’s the definition of 
telephony metadata which you will 
need throughout this course. 

■(T3//3I//NF) The Telephony Metadata 
obtained from the BR FISA is 
comprehensive communications 
routing information. Specifically it may 
contain:: 

» Originating and terminating 
telephone numbers 

• International Mobile Subscriber 
Identity (IMSI) numbers 

• Mobile Subscriber Integrated 
Services Digital Network 
(MSISDN) numbers 

* International Mobile station 
Equipment Identity (IMEI) 
numbers 

* Trunk identifiers 

* Telephone calling card numbers 

• Time and duration of calls 

- (TS//S I //NF) The BR FISA authority 
does not extend to the content of these 
communications. The BR FISA does 
NOT include substantive content of 
any communication, or the name, 
address, or financial information about 
a subscriber or customer. 



also known as 

I Identifiers 







(TS//S I // N F) A telephony identifier 
(selector), is called a Seed when it is 
being used to search the BR 
repository. When querying the BR 
metadata repository, Business 
Records FISA (BRF)-approved 
individuals, also known as BRF 
chainers, conduct contact chaining 
^queries in 

order to obtain the contacts between a 
seed and other telephone identifiers 
(numbers in contact with the RAS- 
approved-Seed). 



RAS- 

approved 

Seed 



Selector 

One 



(TS//S I //NO Under the BR FISA 
Order, a query always begins with a 
RAS-approved-Seed. In this case the 
RAS-approved-telephone identifier is 
called a ‘Seed’ because it is being 
used for chaining and analysis to 
create a ‘tree’ of contacts and identify 
new potential terrorist associations. 



Selector 

Two 



FISC authorizes third hop chaining, 

CT Policy limits chaining through 2 hops 



f T3//3l//NF) The BR FISC Order 
authorizes “3-hop chaining”; however 
it is CT’sf.j_] recommended practice to 
restrict chaining to two hops. This 
means that telephony identifiers up to 
two hops away from the Seed may be 
chained. Chaining reveals the 
contacts of the identifier. 



Quantity of 

contacts 

onlv 
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■<j&Pi Lesson 1 Slide 6 “Associations to esteblishaf^Snominatton^J 



(T S //S1//NF) Recall that the BR FiSC 
Order allows NSA to obtain an 
immense amount of foreign and US 
metadata contained in the Business 
Records. The FISC Order contains 
strict guidelines on when this metadata 
is allowed to be accessed and when it 
is not. It must be associated with 
specific terrorist organizations named 
in the Order. It also must meet a 
standard that is referred to as the 
Reasonable Articulable Suspicion 
(RAS) Standard. In a nutshell, the 
RAS standard requires that an NSA 
analyst must be able to point to a 
single fact that points to the fact that a 
seed/telephone selector may be 
associated with a terrorist group listed 
in the FISC Order before we are 
authorized to conduct analysis on it. 






Associations to establish a RAS nomination 



Reasonable Articulable Suspicion (RAS) standard - requires that an NSA analyst 
must be able to point to a single fact that points to the fact that a selector may be 
associated with a terrorist group listed in the FISC Order before we are 
authorized to conduct analysis on it. 



(TS//S I //NF) We will address the RAS 
standard in detail in the next lesson, 
but for now, understand that the fact or 
facts which make up a RAS 
determination should cause a 
reasonable person to suspect that the 
identifier is associated with one of the 
terrorist organizations named in the 
Order. 






RAS determination - should cause a reasonable person to suspect that the 
identifier is associated with one of the terrorist organizations named in the Order 
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Lesson 1 Slide 7 “Legal Disclaimer’ 



(U// FOUO) This course is not 
designed to take the place of specific 
guidance from a Homeland Mission 
Coordinator (HMC), the Office of 
Oversight & Compliance (SV), or from 
the Office of General Counsel (OGC). 
The course is designed to enhance 
your understanding of how to comply 
with the BR FISC Order and to 
understand the RAS standards used in 
concert with BR FISA. 

(U// rOUO) Because, the BR FISC 
Order is renewed approximately every 
60-90 days, the FISC may change the 
authority or place new restrictions in a 
new FISC Order. It is important to 
understand that unique operational 
circumstances may result in a change 
in guidance from this course. 
Therefore, if you experience any 
uncertainty (delete) it is always sound 
advice to contact your local HMC, SV, 
or OGC for case-specific guidance. 



Renewed approximately every 60-90 days 

Contact your local HMC, SV, or OGC for case-specific guidance. 
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Lesson 1 - Introduction to the Business 






Legal Disclaimer 

This course: 

IS NOT designed to take the place of: 


IS designed to enhance understanding of: 


Homeland Mission Coordinator {HMC} 


BR FISC Order 


Office of Oversights Compliance (SV) 


RAS standards 


Office of General Counsel (OGC) 






Lesson 1 Slide 8 “Summary” 



(T8//S I //NF) You have now completed 
the lesson that discusses the BR 
FISA authority. 



Summary 

You should now be able to 



(TS//SI//NF) You should now be able 



Identify the purpose of the BR 
FISA Order 
Recognize the I 

groups covered by the 
BR FISA Order 

Define terms relevant to the BR 
FISA Order: telephony 
metadata, telephony identifier, 
hops, and Seed 



identify the purpose of the BR FISA 
Order 

Recognize the | 

groups covered by the BR FISA 

Order 



Define terms relevant to the BR FISA 
Order: telephony metadata, telephony 
identifier, hops, and Seed 
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Lesson 1 - Introduction to the Business 
Records (BR) 
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fl SI Z/NF) This lesson provides an overview 
of the Reasonable Articulable Suspicion 
(RAS) Standard. RAS guidance is outlined 
in an OGC memo. It provides definitions 
and descriptions that will help you 
understan^aoja^^^aij^^sA^^B^ioj^Q 

onyhnj £q 

F..iM identifiers under the BR Court Order. 






#SJ //NF) Recall that the BR FISA Order lists 
those specific terrorist groups that are 
associated with either Br I 



H BR FISA course lessons: 

S Lesson 2 - Summary of the Standard 



| You can access the most 
current BR Order from the links on the Legal 
Readings button in this course. 



1 //6I//NF) The BR FISA Order also states 
that in order to access the BR FISA 
metadata, NSA must establish RAS on each 
selector that it wishes to query within the 
metadata. Only a Homeland Mission 
Coordinator (or named individual in the 
Order) may make a RAS determination and 
thus authorize a selector for querying. 
However, you are responsible for ensuring 
that a selector has been approved for RAS 
prior to querying the BR FISA metadata. 

You may even be responsible for drafting 
RAS requests outlining why a selector 
should be RAS approved. 



| “Define the Reasonable Articulable Standard (RAS) used to 
justify a BR FISA metadata search 

•Identify prohibitions against instinct and hunches in contrast 
to facts 

•Identify common sources of information used for justifying a 

RAS 

•List the common sources of information on which analysts 
rely in making RAS determinations 



- (TS//S I //N P)This lesson will enable you to: 

- Define the Reasonable Articulable 
Standard (RAS) used to justify a BR 
FISA metadata search 

• Identify prohibitions against instinct 
and hunches in contrast to facts 

• List the common sources of 
information on which analysts rely in 
making RAS determinations 

• List the ten most typical sources of 
information on which analysts rely in 
making assessments of Reasonable 
Articulable Suspicion (RAS) 



Derived From: NSA/CSSM 1-52 
Dated: 20070108 
iM g^DedassBy Qn; v 20341001 - 
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Lesson 2 Slide 2 “Summary of RAS Standard” 



(TG//GI//NF )- You will recall from Lesson 
One that the BR FISA Order is authorized 
because the FISC recognizes there is a 
counterterrorism interest in obtaining those 
business records. However, because NSA 
is receiving a great deal of US person 
telephony records, we have strict 
guidelines on when NSA can access the 
metadata under this authority. One of the 
requirements is that in order to access the 
metadata, NSA must establish RAS on 
each selector prior to querying the BR 
FISA repositories. 



Summary of RAS Standard 






BR FISC Order 



Government may request to use specific identifiers to' 
query the metadata for purposes of obtaining foreign 
intelligence through contact chaining or| 

• telephone numbers 



(TG//G 1 //N1~) T he BR FISC Order states 
that NSA mav a ueoe specific identifiers 



|that satisfy the RAS standard for 
purposes of obtaining counterterrorism 
intelligence. 



Reasonable Articulable Suspicion standard 



(TS//S I //NF) In order to assist in 
determining when a selector has satisfied 
the RAS standard, the Office of General 
Counsel (OGC) has issued a RAS Memo 
to help Signals Intelligence Directorate 
(SID) personnel make RAS determinations 
on telephone identifiers. The memo 
contains guidelines that apply to both the 
BR and Pen Register and Trap and Trace 
(PR/TT) FISA Orders. 









■mm. 








(TS//SI// N O In order to query the BR FISA 
metadata, BRF authorized individuals may only 
query selectors that have been RAS approved 
by a Homeland Mission Coordinator (HMC) (or 
other named officials in the FISA Order). A 
HMC determines, based on the factual and 
practical considerations of everyday life, 
reasonable and prudent persons act, whether 
or not there is a reasonable articulable 
suspicion that the selector is associated with M 



V . Lesson 2 Slide 3 “RAS Standard. Definition” 



RAS Standard Definition 



There must be at least one qualifying fact giving 
rise to a reasonable articulable suspicion that 
the identifier is associated with one of the 
terrorist groups listed in the BR FISA Order. [.31 



RAS standard requirements 



f r - S//S1//NF) The RAS must be approved 
BEFORE you can j\4] use an identifier to query 
the BR metadata. Analysts are not allowed to 
use a hunch or a guess to nominate selectors 
for RAS. RAS nominations or requests 
nominations must specify facts that would 
cause a reasonable person to form that 
suspicion. 



facts) that cause suspicion the number is associated 



must be approved by the a Homeland Mission Coordinator or other named officaJ in tie 
FISC Order before you use a telephone number identifier to query the database of records 

no hunches or guesses to justify targeting 



(U/ /rQUQ) -The RAS standard is far less than 
proof by “probable cause" or “a preponderance 
of evidence” - it merely requires one fact that 
can be articulated which would cause a 
reasonable person to form a suspicion. 
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Lesson 2 Slide 4“Sources of Information” (Jncj. 3) 



7S I //NF) Information used as a basis to 
satisfy the standard often comes from one 
of the following in-house resourcesf.21 : 

A published NSA report 
Unpublished SIGINT collection where 
new accounts have been revealed (and 
can be documented) 



A published NSA report 
Unpublished SIGINT ool lection 



Content analysis 
SJSDEVwork 

Any content analysis where a targeted person 



Content analysis that references new 
identifiers in phone 1 " ■ 

collection 

SIGDEV work tied to published 
information or part of a target 
development effort 

Any content a nalys is wher^^arceted 

person^^^lfiHSSH 

Direct electronic communication with a 
identifier that is already known to be 
associated with the Foreign Powers 
through prior BR / PRTT or other 
SIGINT resources 

Information from NSA taraet knowledae 



7. Direct communication 

S. NSA target knowledge databases 



Information obtained fromHHHHI 
belonging to one of the Foreign Powers 






(TG//S I //Nr) Searching the Business Records 
metadata is targeting, not analysis. 

- Therefore to make a RAS determination, 
other information sources must be used 
for research and analysis. Remember 
that the RAS standard is merely a reason 
for suspicion through one or more stated 
facts, so the standard is not as high as 
most FISC content surveillance 
authorities. 








Lesson 2 Slide 5 “Sources of Information” (End. 3) 



fTS//SI //NF) The RAS memo also lists other 
sources of information available for researching 
a RAS: These include but are not limited to: 
Published reports such as: 

• SIGINT reports 

• Investigations by the CIA or FBI 

• FISA surveillance data derived from other 
authorized targets 

• SIGDEV work tied to published information 

• Other transcripts 

(TS//S I//NP)- Looking at the 1C and public sector 
(open source) f.2] sources we use, these 
include: 

• The Federal Bureau of Investigation 

• The Central Intelligence Agency 

• The National Counterterrorism Center 



Sources of Information 



SIGINT reports 

Investigations by the CIA or FBI 
FISA surveillance data derived from other 
authorized targets 

SIGDEV work tied to published infermafioi i 
Other transcripts 



Resisted' report! 



Preliminary i rcvestig aliens 
Full field investigations 



Public records available on the internet, 
news papers or other public resourcesf.31 



SIGDEV work tied to published infer 
Transcripts 
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Lesson 2 Slide 6 “Summary 3 ’ 



(U//F000) You have completed the lesson 
summarizing the RAS standard 



(TG//G I //NI~) You should now be able to: 



SUMMARY 



Define the Reasonable Articulable 
Standard (RAS) used to justify a BR 
FISA metadata search 
Identify prohibitions against instinct 
and hunches in contrast to facts 
Identify common sources of 
information used for justifying a RAS 
List the common sources of 
information on which analysts rely in 
making RAS determinations 



You should now be able to 



•Define the Reasonable Articulable Standard (RAS) used to 
justify a BR FISA metadata search 

•Identify prohibitions against instinct and hunches in contras 
facts 

•Identify common sources of information used for justifying £ 
RAS 

•List the common sources of information on which analysts 
rely in making RAS determinations 
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Lesson 3 Slide 1 “Lesson Objectives’ 



frs//si//i s ir) This lesson is a 
continuation on the Reasonable 
Articulable Suspicion (RAS) standard 
guidelines. 



f TS//S I //NF) RAS determinations are 
approved by a HMC (or an official 
named in the Order) BEFORE queries 
can be made using a particular 
selector within the BR metadata. 
Another restriction associated with 
RAS is the prohibition of making a 
RAS determination based solely on 
activities protected by the First 
Amendment. 



Lesson 3 - First Amendment Considerations 



List some basic protections of US persons 

provided by the First Amendment of the US 
Constitution. 



(TS//S I //NF) At the conclusion of this 
lesson, you should be able to: 

• List some basic protections for US 
persons provided by the First 
Amendment of the US 
Constitution. 

• Describe the prohibition against 
using First Amendment protected 
activities as the sole justification 
for RAS involving a US person (as 
defined in USSID SP0018). 



Describe the prohibition against using First 
Amendment protected activities as the sole 
justification for a RAS involving a US person 



Derived From: NSA/CSSM 1 - 52 
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(U// FQUO) The First Amendment of 
the US Constitution prohibits Congress 
from making any laws that would 
infringe on the free exercise of: 



w®m 



W1 



mmm 



Religion 
Speech 
The press 

Peaceable assembly 
To petition the government for 
redress of grievances 



Memo clarifies the FISC's prohibition 
of a RAS determination based solely 
on activities that are protected by the 
First Amendment. This applies when 
targeting a US person as defined in 
USSID SP0018 or a person 
reasonably believed to be located 
inside the United States. 
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Lesson 3 Slide 4 “Summary” 



MBmmmmmmm 



(TS//S1//NF) You should now be able 



List five basic protections for US 
persons provided by the First 
Amendment of the US 
Constitution. 

Describe the prohibition against 
using First Amendment protected 
activities as the sole source of 
justification for an identifier. 



SUMMARY 



You should now be able to 



•List five basic protections for US persons 
provided by the First Amendment of the US 
Constitution 



•Describe the prohibition against using First 
Amendment protected activities as the sole 
source of justification for a selector involving a 
US person. 
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Lesson 3: First Amendment Considerations 
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fTS//S I //NF) In this lesson we will 
examine a Business Records (BR) 
FISA Court (FISC) Order. At the 
conclusion of this lesson you will be 
able to: 



•Identify BR FISC Orders as NSA’s 
authorization to collect telephony 



V r J 

H metadata from specified US 
‘-3 telecommunication companies in order 
ml to protect against international 
■ terrorism 



D e riv e d F rom ; NSA/CSSM 1 -5: 



Doted : 20070 408- 



Declassify On: 20341001 
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■ (TS//S I //NF) BR Orders allow NSA to obtain telephony 
metadata from US telecommunication companies, 
compelled to do so under a court order. This FISA 
Order requires specified telecommunication providers 
to share business records in the form of telephony 
metadata with the US government. 



What are BS Orders.' 



. @0 » SO days 



What are BR Orders? 



The authority is for collection of tangible things 
gathered by the FBI to protect the US against 
international terrorism. 

a The RAS standard requires an ability to 
articulate an association with I 



terrorist 



groups listed within the order. 



BR FISA authority is for collection of 
tangible things gathered to protect the United States 
against international terrorism. BR Orders are 
renewed approximately every 60-90 days. We will refer 
to the valid order as the FISA BR Order. 

(TS//S I //NF) Since this authority is concerned only with 
metadata and no content of those communications, 
NSA has a lower burden of proof for targeting an 
identifier when compared to other FISA authorities. 

f T6//6 l //NF) All that is required is that a selector meet 
the Reasonable Articulable Suspicion (RAS) standard 
that a selector is associated with a terrorist group 
listed in the BR FISA Order. All of the listed terrorist 
groups are associated with I 



(TG//G I //NF) ~AII identifiers are approved by an HMC (or 
official named in the Order) prior to querying the 
authorized repositories. 

(TS//S I //NF) NSA can use identifiers, after they have 
been approved for RAS, to query the BR metadata for 
counterterrorism threats to the homeland. The BR 
Court Order only authorizes contact chaining and 
queries within the metadata. 
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(TS//S I //N!~) The BR Order clarifies 
“tangible things” to mean an electronic 
copy of telephony metadata (call 
records). This includes: 

• Comprehensive communications 
routing information including: 

• Originating and terminating 
telephone number 

• International Mobile 
Subscriber Identity (IMS!) 
number 

• International Mobile station 
Equipment Identity (IMEI) 
number 

• The trunk identifier 

• Telephone calling card numbers 

• Time and duration of call 



'‘Tangible Things as only Telephony metadata' 



"tangible things" 

’an electronic copy of telephony metadata {call records) 



Comprehensive communications routing information including: 

• Grigmaiion and terminating telephone number 

a International Mobile subscriber identity (iJSI) nureiber 

* International Mobile station Equipment identity (WEI) number 
Th&tnmfeidsntier 

Telephone calling card numbers 
In® and duration of call 



The telephony metadata does not include fie substantive content of any communication! or fie name, 
address, or financial infaunal on of a subscriber or customer within 'these. 



(TS//SI//NF) The BR FISA Order 
specifically states that the telephony 
metadata does not include the 
substantive content of any 
communication or the name, address, 
or financial information of a subscriber 
or customer within these. The FISA 
Order deliberately restricts access to 
only communications metadata. 
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the BR FISA authority is used to establish 
connections with terrorist organizations by 
using contact chaining and 

_ queries. These queries look at 
the contacts of known terrorists to help 
NSA establish new connections and 
affiliations with terrorist groups listed in the 
court order (i.e. the Foreign Powers). 



* Justifies the search of metadata 



metadata repository, NSA must establish 
RAS on each selector in order to conduct a 
search within the metadata. RAS is a 
statement of fact that supports a 
reasonable suspicion that the identifier is 
affiliated with one of the terrorist groups 
listed in the BR FISA Order. Only 
Homeland Mission Coordinators and 
others named in the BR FISA Order can 
make a RAS determination. 



one of the terrorist groups listed in the BR 
FISA Order. 



WmM 
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be solely based on activities which are 
protected by the First Amendment of the 
US Constitution. 

(TS//S I //NF) To see samples of RAS 
statements please open the, ‘RAS 
statements’ Job Aid located in the legal 
readings for this course 
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(TS//S1//NF) You should now be able to 



Identify BR FISC orders as NSA’s 
authorization to collect telephony 
metadata from specified US 
telecommunication companies in 
order to protect against 
international terrorism 



Identify BR FISC orders as NSA’s authorization to collect 
telephony metadata from specified US telecommunication 
companies in order to protect against international 
terrorism 
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(TS//SI//N F}- In this lesson we will 
continue to examine the Business 
Records (BR) FISA Court (FISC) 
Order. At the conclusion of this lesson 
you will be able to: 



In this lesson we will continue to examine the Business Records (BR) 
FISA Court (FISC) Order. At the conclusion of this lesson you will be 
able to: 



Distinguish between analysts 
authorized to query BR FISA 
metadata and individuals 
authorized to receive results of 
those queries 



• Distinguish between analysts authorized to query BR FISA 
metadata and individuals authorized to receive results of those 

queries 



Identify further limitations on 
accessing, sharing, disseminating 
and retaining BR FISA metadata 



• Identify further limitations on accessing, sharing, disseminating 
and retaining BR FISA metadata 



D e riv e d From: NSA/CSSM 1 52 ■ 
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(TS//S I //NF) The Director of NSA 
(DIRNSA) strictly controls access to 
and use of raw BR metadata. 



f FS//S I //NF) Query access to BR raw 
metadata is limited to individuals 
trained and designated as BR FISA 
Query Analysts. This is the only group 
permitted to query raw BR FISA 
metadata for contact chaining and 
(purposes. The BR 
FISA Order limits the number of 
individuals who can be named in this 
category as well as how many can be 
designated as Homeland Mission 
Coordinators. There are several other 
categories of people who are 
authorized to access the raw metadata 
such as technical individuals and Data 
Integrity BR FISA Analysts; those who 
access the repository for the purpose 
of ensuring that the data is compliant. 
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The BR FISA Query Analyst 

The Director of NSA (DIRNSA) 
strictly controls access to and use of 
raw BR metadata. 



“The BR Analyst’ 



T!ib Director of NSA (D iRNS A) strictly contra Is access band use ofravBR metadata. 



“The BR Analyst" 

Query access la BR iaw metadata is limited b individuals trained and designated as BR 
FISA Query Analysts. 



Query access to BR raw metadata 

is limited to individuals trained and 
designated as BR FISA Query 
Analysts. 



(TS//S I //N F) The BR metadata is 
authorized to be stored in two NSA 
repositories — | 



Authorized Query Analysts are 
permitted to auerv BR raw metadata 
within 

|to receive query results. 



The BR metadata is authorized to 
stored in two NSA repositories — 



‘The BR Analyst’ 



The BR metadata is anlhnrizEd in be Hnred in hw NSA rmn sib rips- 
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(U//FOUO) This is very important so 
we’il reiterate it with more detail. 



Oversight for Access Restrictions 



Directorate’s Office of Oversight and 
Compliance has implemented a series 
of auditing controls designed to limit 
access to the BR FISA metadata only 
to those who have been briefed by the 
OGC and those who have completed 
all of the required training. 



(T3//3I//NF) When the raw metadata is 
accessed in order to perform a query, 
an automatic audit log is recorded that 
includes: 

• Query request 

• User login 

• Internet protocol address 

• Date and time of the access 



>fc$i 



BR Court order requires logging for auditing purposes 
•Query requests 

• User login 

• IP address 

• Date and time of the access 
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( TS//S I #NR} Remember only a select 
number of analysts are authorized to 
query the raw metadata. 



Distributing BR FISA query results 



FISA query results the distributions are 
categorized as thoseffhte mal to -M-Sg^ 
which will be called ‘SlTaring’ and 
those outside of NSA which will be 
called ‘Dissemination’. 



(TS//S I //NF) It is the BR FISA Query 
Analyst’s responsibility to ensure that 
the recipient of the query results is 
approved to receive BR derived 
information. 



ail 



it is the BiR FISA Query Analyst* s responsibility to ensure that the recipient of the query 
results is approved to receive BR derived information. 



itlK 
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’|[ (U// FOUO) Before we discuss 
1 distribution, it is imDortant to di 



distribution, it is important to define 
query results. So, what are query 
results? 



f TO//Ci l //Nr) A “query result” is a piece 
of information that would not have 
been known, or a statement of fact or 
opinion that would not have been 
made, but for information revealed 
following a BR or Pen Register and 
Trap and Trace (PR/TT) query using a 
RAS (Reasonable Articulable 
Suspicion) -approved selector. 



This definition includes information 
in the form in which it appears 
immediately followh^^^^m- 
PR/TT query, 
well as information 1 
changed form, e.g., a statement 
describing certain links in a 
contact chain. Summaries derived 
from BR chaining are also query 
results. 

This definition makes no 
distinction between minimized and 
unminimized information. 
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(TS//9)/Nr) Sharing of BR FISA query 
results can take place formally or 
informally and may take place orally or in 
writing, Sharing can even include a phone 



Sharing Procedures 



fFS//6 l //Nf~) So, when go the restrictions 



on the sharing of query results cease to 
||| apply? 



■ {TS//S I //NF) The term “query result” does 
not govern properly disseminated SIG1NT 
products containing information derived 
from authorized queries of the BR or 
PR/TT metadata. 



Sharing Procedures 



- fT8//8l//NP) The term “query result” does 
not extend to identifiers discovered as a 
result of authorized queries of the BR or 
PR/TT metadata, to the extent those 
identifiers are used for tasking purposes 
elsewhere. E.g., a foreign identifier 
discovered as a result of an authorized BR 
query may be tasked in BE 
neither the tasking information contained in 
Jnor the collection that results 
would continue to require the sharing 
restrictions applicable to BR query results. 
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sharing a query result is responsible 
for ensuring that the recipient is 
authorized to receive it. To see your 
current responsibility please refer to 
the job-aid entitled BR FISA Query 
Analyst Responsibilities. 



BR FISA query results 



(TS//S I //N F) Individuals who receive 
BR derived information (query results) 
must be briefed by the OGC and have 
current OVSC1800 training. They will 
be authorized by SID Office of 
Oversight and Compliance SV4 to 
receive BR query results. Remember, 
authorization to receive query results 
does not authorize access to BR raw 
metadata. 
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(T S // SI //NF) If any BR FISA derived 
metadata is to be shared or 
coordinated beyond the personnel who 
are approved to receive it, contact the 
Office of Oversight and Compliance or 
OGC BEFORE you share! 



Sharing Procedures 



If any BR FISA derived metadata is to be shared or 
coordinated beyond the personnel who are approved to 
receive it, contact the Office of Oversight and Compliance or 

the Office of General Counsel BEFORE you share! 
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(TS//S 1 //NF) The court-ordered 
minimization procedures for BR FISA 
disseminations differ from NSA’s 
standard USSID SP0018 procedures 
in the following key aspects: 



Dissemination Procedures 



1 .The Chief of S12 (or approved 
officials named in the court order) 
or the National Security 
Operations Center Senior 
Operations Officer (NSOC SOO) 



The Court Ordered procedures for disseminations of 
query results apply from USSID SP0018. In addition 
there are a couple of unique requirements: 



must approve the dissemination of i ljfi j 
US person information, (please 
refer to the glossary for a definition s||»{ 

of dissemination) <Sp® 

2. Dissemination of US person IgMl 

information must be for a 
counterterrorism purpose and only 

if necessary to understand or 
assess the counterterrorism W$ 

purpose. This applies to both BR if -gg 
FISA Query analysts and \‘Wk 

individuals who have received | T 

query results. ■ gb 

3. Further, all disseminations must 

be reported in a weekly report to || 

the FISC. Ym 



Chief SI 2 or the NSOC SOO {or one of the three other 
named positions in the BR FISA Order) must approve 
the dissemination of US person information 



Any US person information disseminated must be for a 
counterterrorism purpose and necessary to understand 

the counterterrorism information or assess its 
importance. 
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(TS//S I //NF) Retention of raw 
metadata, chain summaries, and 
query results is limited to 5 years 



Retention 



(TS//S I //NF) This applies to all 
repositories holding BR FISA 
metadata. 



Retention of raw metadata, chain sum manes, and Query results is limited to 5 years 
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Lesson Summary 



Distinguish between 
analysts authorized to 
query BR FISA metadata 
and individuals 
authorized to receive 
results of those queries 
Identify further limitations 
on accessing, sharing, 
disseminating, and 
retaining BR FISA 
metadata 



You should now be able to 



Distinguish between analysts authorized to query 
BR FISA metadata and individuals authorized to 
receive results of those queries 
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Identify further limitations on accessing, sharing 
disseminating, and retaining BR FISA metadata 


























“ Where do we go from here?” L5S12 



(TS//SI//NF ) If you have not already 
done so, please read the BR Order 
and RAS Memo located in the Legal 
Readings icon. Then proceed to the 
Final Exam to take the test. After you 
have completed the test, to gain 
access to the metadata, SV4 will need 
to review and approve your access. 



Homeland Mission Coordinators 
DL S2I41J4MC (ALIAS) S2I5 



(U//F OUO) As always, it is important 
to remember that your Homeland 
Mission Coordinator, Oversight and 
Compliance, and the Office of General 
Counsel are available to answer any 
specific questions you may have 
relating to these authorities. 
Remember that this is the BR FISA 
course and does not replace training 
on other FISA authorities. 

Here are some contacts: 

Homeland Mission Coordinators: 

DL S2I41_HMC (ALIAS) S2I5 
Oversight and Compliance: 

SV4 DL_SV42 
General Counsel: 



Oversight and Compliance 
SV4 DL SV42 



General Counsel 
‘go go 5 or 






